Linux Basic optimization

Summary of Linux Fundamentals optimization Review:

1. No root, add a normal user, through sudo authorization management

Useradd Rainlog

passwd Rainlog 123456

Visudo or Vi/etc/sudoers

（

YY copy Current line P paste
Root all= (All) all
Rainlog all= (All)/usr/sbin/useradd/usr/sbin/userdel

After saving, users can be created with normal user (sudo useradd KKK)

---------------------------------------------------------------
Root all= (All) all
Rainlog all= (All) Nopasswd:all
sudo su-Login to root without entering the root password

）

2. Change the default remote connection SSH service port and disable the root user remote connection

Vi/etc/ssh/sshd.config

(

Remote connection port sshd_config file modification Port 52113
Permitrootlogin no does not allow root SSH login, this machine can log in
Usedns No
Permitemptypasswords No
................
: Set NU Displays line number
/etc/init.d/sshd Restar Restart sshd Service

/etc/init.d/iptables stop is not connected to temporarily shut down the firewall

)

3. Scheduled automatic update of server time

/usr/sbin/ntpdate time.nist.gov Interim Execution Time Update

Scheduled Tasks
echo ' #time sync by Oldboy at 2010-2-1 ' >>/var/spool/cron/root
Echo ' */5 * * * * */usr/sbin/ntpdate time.nist.gov >/dev/null2>&1 ' >>/var/spool/cron/root executed every five minutes
Crontab-l

4. Configure the Yum update source to download and install the RPM package from the domestic update source

Update Preparation: cd/etc/yum.repos.d/

CP Centos-base.repo Centos-base.repo.ori
wget Http://mirrors.163.com/.help/CentOS6-Base-163.repo
MV Centos6-base-163.repo Centos-base.repo

5. Turn off SELinux and iptables (iptables work scenario if a WAN IP is typically turned on, except for high concurrency)

Sed-i S#selinux=enforcing#selinux=disabled#g/etc/selinux/config off SELINUX warning

Getenforce viewing the status of SELinux
Setenforce 0 temporary closure changed to permissive

We can also edit the file and then restart it to take effect.

Vi/etc/sysconfig/selinux

Change the line inside to

Selinux=disabled

After you change it, save it, and then restart it.

6. Adjust the number of file descriptors, process and file opening will consume the file descriptor

Ulimit-n viewing file descriptors
ULIMIT-HSN 65535 enlarge file descriptor (temporary)
Echo ' *-nofile 65535 ' >>/etc/security/limits.conf (permanent)

7. Automatically clean up/var/spool/clientmquene/directory garbage files regularly, prevent inodes nodes from full (c6.4 default No

SendMail, can not be configured)

Workaround: Add >/dev/null after cron automatically executes the statement 2>&1
Cases:
4 3 * * */usr/bin/w >/dev/null 2>&1
This will be OK to pull, will not write to that directory ....

Say here a little,/var/spool/clientmqueue directory file too many, RM-RF * time will prompt:

"-bash:/bin/rm:argument list too long".
It means that the parameters are too long for RM to dry.
You can use ls | xargs rm-f this command to delete all files in the/var/spool/clientmqueue directory.

Ok. Clean-up finished ~

8. Thin boot auto-start service (Crond,rsyslog (5.8 syslog), network,sshd)

Chkconfig--list|grep "3:on" View Software command line (3) started
For Rainlog in ' chkconfig--list|grep ' 3:on ' |awk ' {print '} ';d o chkconfig--level 3

$rainlog Off;done to close all startup items
For Rainlog in Crond sshd network Rsyslog;do chkconfig--level 3 $rainlog on;done These four entries open
or with a single command.
For Rainlog in ' chkconfig--list|grep ' 3:on ' |awk ' {print '} ' |grep-ve ' crond|network|

Rsyslog|sshd "';d o chkconfig--level 3 $rainlog off;done

9. Linux kernel parameter optimization/etc/sysctl.conf, execution sysctl-p effective

10. Change character set, support Chinese, but suggest or use English character set, prevent garbled problem, do not use Chinese

Chinese display
vi/etc/sysconfig/i18n
Lang= "ZH_CN. GB18030 "
source/ect/sysconfig/i18n
View language echo $LANG

11. Lock Critical System files

Lock critical files
Chattr +i/etc/passwd/etc/shadow/etc/group/etc/gshadow/etc/inittab
Chattr-i Unlocking
Mv/usr/bin/chattr/usr/bin/test renaming
Lsattr Display the file properties set by the Chattr command

12. Clear the/etc/issue, remove the system and kernel version before the login screen display

Clear the version number
Cat/etc/issue
>/etc/issue or Cat/dev/null >/etc/issue

This article is from the "CentOS Essentials optimization" blog, so be sure to keep this source http://4034605.blog.51cto.com/4024605/1979826

Linux Basic optimization